Dynamic code analysis: What it is and isn’t in application security testing

Key takeaways

 

• There isn’t any such factor as dynamic code evaluation in safety testing as a result of dynamic evaluation doesn’t analyze code. 
• Dynamic evaluation simulates real-world assaults to identify vulnerabilities that may’t be discovered with static evaluation, together with internet server misconfigurations. 
• Dynamic evaluation also can make use of latest instrument sorts that mix options of static code evaluation and dynamic utility testing. 

Sort dynamic code evaluation right into a search engine and the security-focused outcomes might confuse you. And naturally they’d, since your start line is a misnomer: dynamic code evaluation isn’t a factor in safety. Dynamic evaluation is the true factor, but it doesn’t analyze code in any respect; it analyzes far more. 

Many search outcomes muddle up dynamic code evaluation with dynamic utility safety testing (DAST) – however the latter exists, whereas the previous doesn’t. DAST is a testing course of that checks a working internet utility, on the lookout for the form of runtime vulnerabilities an attacker may exploit. That units it other than static utility safety testing (SAST), which checks the applying supply code for safety vulnerabilities.

However why, then, if dynamic code evaluation doesn’t actually exist, do Google searches for that time period flip up so many safety articles trying to outline it? Easy: Individuals outdoors the safety business usually mistakenly consider DAST because the dynamic counterpart to static code evaluation and search on that phrase, so distributors looking for readership fill the hole with tortured explanations. We’re looking for readership, too, however by calling it the best way we see it.  

The distinction between static and dynamic evaluation

Static evaluation checks the supply code of functions in improvement. It’s useful for recognizing bugs earlier than deployment, for total high quality management within the improvement course of, and to fulfill regulatory necessities. It’s even necessary in some sectors, reminiscent of aviation and medical software program, the place bugs can threaten lives. 

However for real-life usefulness, dynamic evaluation is a should; it simulates every kind of malicious or just misguided inputs – from a nefarious hacker to a careless worker – to search for runtime vulnerabilities. Utilizing DAST instruments, a developer can carry out a dynamic evaluation that simulates an end-user’s actions, performing like an automatic penetration tester. It may probe hyperlinks, varieties, and different capabilities, trying operations like submitting varieties with malicious knowledge to try to exploit an app. 

By itself, dynamic evaluation doesn’t discover the precise location of a misconfiguration or bug and can’t right the problem. That’s left to the safety engineers or builders, however new and improved instruments are streamlining and automating that course of.

Dynamic evaluation within the cloud(s)

Dynamic evaluation received’t test the code in functions working on cloud platforms. Speaking about scanning code implies you have got entry to the applying supply code, which is commonly not the case when counting on an exterior service provisioned over the web. Until you might be growing all the pieces in-house, you might need entry to code libraries or utility programming interfaces (APIs) however to not all the supply code of the app. 

An enormous variety of organizations at this time depend on cloud servers to carry their whole workload. Many additionally mix a number of cloud distributors and even make use of a number of clouds and an on-premises community within the so-called hybrid cloud mannequin. Based on Deloitte, 90% of organizations have been utilizing the cloud for 3 years or extra now, and 79% are on a number of clouds – and that might imply working a variety of supply code that they’ll’t scan. As a substitute, safety and threat administration professionals can use dynamic evaluation to check the conduct of the entire utility because it performs its capabilities, recognizing points which may not be obvious even with full entry to the supply code. 

If an API is front-ending an app in a Google, Azure, or AWS server surroundings, it’s all the time doable to check the API itself, and thus the applying behind it, whatever the code working on the cloud server internet hosting the app. Testing the best way the applying reacts when utilizing the API is a real-world approach to test your safety posture and defenses, whereas working a SAST check solely supplies some indication of code high quality. 

The advantages of dynamic evaluation

Dynamic testing will help safety analysts spot insecure configurations and configuration errors that have an effect on the applying. Even assuming your utility code is completely positive, the net server could also be configured in a approach that enables an assault. It is a large deal at a time when CISOs say safety configurations are amongst their high issues; for instance, one survey mentioned two-thirds of responding CISOs are frightened about safety misconfigurations inflicting a breach. 

As a sensible instance, dynamic evaluation can spot misconfigurations that allow clickjacking assaults, the place a fraudster overlays or in any other case embeds a malicious URL in benign clickable content material in your web site. Customers clicking in your website components are then redirected to a malicious website – positively not the place you initially supposed to ship them. This can be utilized for URL phishing, the place attackers trick an individual into clicking on a hyperlink they’d in any other case not have touched, although that’s solely considered one of many potentialities for cybercrime. 

However that’s not an issue of code, it’s an issue of internet server configuration. The important thing protection in opposition to clickjacking is to make use of safety headers that forestall different websites from embedding something in your pages. That protection have to be configured on the internet server and has nothing to do with utility code safety, so SAST or any code evaluation instrument wouldn’t establish the misconfiguration that opens up a vulnerability – however dynamic evaluation can spot it. 

Dynamic evaluation must be a part of any safety regime, and mixing static and dynamic evaluation instruments supplies the best means to get the very best of each worlds. Scanning code ought to all the time be part of safe improvement practices, however dynamic evaluation supplies a broader and extra real looking layer of safety testing that may actually assist CISOs sleep higher at evening. 

The underside line

For one thing that doesn’t exist in utility safety, too many internet searches and hundreds of phrases have been generated about “dynamic code evaluation.” Dynamic utility safety testing, alternatively, is not any mirage. It’s a very actual and very helpful course of for locating all kinds of attackable vulnerabilities in internet functions – particularly vital at a time when a lot relies on cloud safety.